Data Export [Was Re: [LINK] RFC: Web 2.0]

[Roger Clarke]

[Original RFI at top, response at bottom]

At 9:16 +1100 24/11/06, Craig Sanders wrote:
>>      http://www.rememberthemilk.com/
>
>why would anyone want to put their personal data and to-do list on
>someone else's computer, where they lose all control over it? and when
>the site's privacy policy says:
>
>    "Personal information collected by Remember The Milk may be stored
>    and processed in the United States or any other country in which
>    Remember The Milk maintains facilities. By using Remember The Milk,
>    you consent to any such transfer of information outside of your
>    country.
>
>    We reserve the right to transfer your personal information in the
>    event of a transfer of ownership of Remember The Milk, such as
>    acquisition by or merger with another company. In such an event,
>    Remember The Milk will notify you before information is transferred
>    and becomes subject to a different privacy policy."
>
>i'm not even sure that's legal in australia (RTM is, according to whois,
>based in Chatswood, NSW). i really hope you can't get around australian
>privacy laws by simply posting a notice in the fine print that you'll be
>exporting data to some country without adequate data protection.


I posted the above on the privacy list, followed by:
>Anyone know the answer?


This answer came today from Graham Greenleaf <graham at austlii.edu.au>

Of course you can! - probably  :-)

NPP 9 
<http://www2.austlii.edu.au/privacy/Privacy_Act_1988/index-Schedule-3.html#Heading244> 
allows transfers where '(b) the individual consents to the transfer'. 
But consent includes 'implied consent' (by definition). The Privacy 
Commissioner reckons that this can include opt-out arrangements where 
the notice is prominent enough so that users must be taken to have 
seen it (or words to that effect - can't source it right now).

So my guess is that it will depend largely on how prominent the 
privacy notice is ... but it really is only a guess as to what 
'implied consent' might mean.

Cheers,

Graham

-- 
Roger Clarke                  http://www.anu.edu.au/people/Roger.Clarke/

Xamax Consultancy Pty Ltd      78 Sidaway St, Chapman ACT 2611 AUSTRALIA
                    Tel: +61 2 6288 1472, and 6288 6916
mailto:Roger.Clarke at xamax.com.au                http://www.xamax.com.au/

Visiting Professor in Info Science & Eng  Australian National University
Visiting Professor in the eCommerce Program      University of Hong Kong
Visiting Professor in the Cyberspace Law & Policy Centre      Uni of NSW